Position SummaryOwn the on-premise network and its security at the Southend Pharmacy compounding facility and across the infrastructure supporting our brands, working with the CTO organization's cloud security team where site infrastructure meets cloud workloads. Beyond keeping things connected, this role builds the logging, alerting, and monitoring layer that lets us see security and availability events, which is our biggest blind spot today. Escalation and change approval run through the IT Operations Lead. Identity-integrated network access is coordinated with the Systems Administrator.
Key Responsibilities- Network Segmentation: Design and maintain zones that separate compounding production systems, PHI-bearing workstations, clinical devices, administrative users, and guest or BYOD traffic, which the 2026 HIPAA Security Rule expects.
- Firewall & Perimeter Management: Own the firewall rule lifecycle, including documented periodic review, change approval, and elimination of undocumented or overly permissive rules.
- Logging Architecture: Deploy and operate centralized log collection spanning firewalls, switches, wireless, servers, endpoints, and pharmacy production systems, with retention configured to the standard set by the compliance program.
- Alerting & Detection: Build tuned alert rules with clear severity tiers routed to a named responder. The goal is a manageable number of alerts that are worth acting on.
- Proactive Monitoring: Track throughput, latency, packet loss, and capacity on production-critical paths, watching trends so problems surface before they turn into outages.
- Site Connectivity & Redundancy: Manage carrier circuits and redundant paths for the pharmacy and supporting sites, and test failover on a schedule so we know it works.
- Wireless Infrastructure: Deploy enterprise wireless with certificate-based authentication and separate production, corporate, and guest SSIDs, tuned for the density of scanners and mobile devices on the production floor.
- Secure Remote Access: Administer VPN and Zero Trust network access for remote staff and offshore contractors, in coordination with the Systems Administrator (Identity & IAM).
- Vulnerability Management: Run regular scans of network-attached infrastructure and track fixes to closure, documenting risk acceptance where a fix is deferred.
- Technical Incident Response: Lead the technical side of security incidents, covering detection, triage, containment, eradication, and the write-up afterward.
- Pre-Authorized Containment: Act immediately on lower-severity events such as isolating an endpoint, disabling an account, or blocking an address, and notify afterward. Escalate to the IT Operations Lead when there is suspected PHI exposure, when an action would affect compounding production, or when an incident stays open past its severity clock.
- Configuration & Change Control: Version all network configurations, keep topology documentation current, and produce evidence supporting SOC 2 change-management controls.
- Circuit & Vendor Governance: Hold carriers and hardware vendors accountable to contracted service levels, and plan end-of-life refresh before equipment becomes an availability risk.
- Site Coverage Backup: Provide on-site coverage for the IT Support Specialist during absences or overlapping production incidents, following documented runbook procedures only. This role does not own tickets or work the standard support queue.
- Coverage: Standard hours are 08:00 to 17:00 CST, Monday through Friday, with participation in an on-call rotation for production-critical and security events outside those hours.
IT Network Specialist - QualificationsEducationBachelor's degree in information technology, computer science, network engineering, or a related field preferred. Equivalent hands-on experience is accepted in place of a degree.
Required Certifications- CCNA, or equivalent vendor certification for comparable platforms (JNCIA, Aruba ACSA, Fortinet FCP), or demonstrated equivalent skill
- CompTIA Security+, or equivalent security fundamentals credential
Preferred Certifications- Firewall certification for Palo Alto PCNSA/PCNSE, Fortinet NSE, Cisco Firepower
- CWNA (Certified Wireless Network Administrator)
- Cisco CyberOps Associate, GIAC GCIH, or comparable incident response training
Required Experience- 5-8 years in network administration or network engineering
- At least 2 years owning a production network environment, including change decisions and escalation, rather than working assigned tickets within someone else's design
- Multi-site experience including carrier circuit management and redundant path failover
- Direct, hands-on firewall rule administration - creating, reviewing, and removing rules under a change process
- Enterprise wireless deployment and troubleshooting
Strongly Preferred Experience- Built centralized logging, monitoring, or SIEM capability from the ground up, including choosing what to collect, configuring retention, and tuning alerts. This is the highest-value qualification for this role.
- Network segmentation in a regulated or production environment - healthcare, pharmaceutical, manufacturing, or PCI-scoped
- Wireless deployment supporting handheld scanners or mobile equipment in a warehouse, production floor, or clinical setting
- Participation in security incident response, including containment and post-incident documentation
- Producing evidence for compliance audits (HIPAA, SOC 2, PCI, HITRUST)
Trainable - Not RequiredHIPAA and SOC 2 specifics, pharmacy operations, and USP 797/800 controlled-area procedures. Candidates with PCI, clinical, or manufacturing OT backgrounds carry transferable instincts and should not be screened out for lacking healthcare experience.
What We Offer:- Full benefits package including medical, vision, dental, 401(k) with company match, PTO, Flex days, holidays, and more!
Allia Health Group does not provide employment visa sponsorship now or in the future. Applicants must be legally authorized to work in the United States without the need for current or future sponsorship.
Monday to Friday 8:00 AM - 5:00 PM
